Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

shouldnt TCP connections made to port 80 come from port 80 as well? or what port do they usually come from when a regular user has a regular browser? i wonder because i wonder if i can limit incoming ports on my firewall

tcp      6 156441 ESTABLISHED src= dst= sport=1164 dport=80 packets=4 bytes=172 src= dst= sport=80 dport=1164 packets=1 bytes=52 [ASSURED] mark=0 use=1
tcp      6 156065 ESTABLISHED src= dst= sport=3133 dport=80 packets=4 bytes=168 src= dst= sport=80 dport=3133 packets=1 bytes=48 [ASSURED] mark=0 use=1
tcp      6 132805 ESTABLISHED src= dst= sport=3526 dport=80 packets=4 bytes=172 src= dst= sport=80 dport=3526 packets=1 bytes=52 [ASSURED] mark=0 use=1
share|improve this question

No, it comes in from the ephemeral ports.

First some basics. A socket, consists of a source port and address, and destination port and address. That socket describes a single line of communication. A socket describes one connection. When packets are received by the operating system it looks at these bits of information to decide what application should get the packet. If you wish to see these connections look at the output of netstat.

If everything destined for port 80 originated from port 80 then you could only ever have one connection between 2 IP addresses. In the real world we frequently want to have multiple connections open to a web (or other) server so we can retrieve things in parallel.

You should also consider the case of something doing network translation (NAT) or more descriptively and more common these days, Port Address Translation. It would be completely unacceptable to only allow one system behind the NAT device to make connections at a time.. So source ports are assigned to each outgoing connection. The NAT devices has to keep a translation table that keeps track of what port+address combinations on the outside belong to what port+address combinations on the inside.

share|improve this answer
+1. Surprisingly this is something that quite a few people don't understand. I once worked with a network consultant who was light years ahead of me in skills and knowledge that didn't understand this. – joeqwerty Oct 27 '09 at 22:42
Good answer. You included a lot more detail than I did. – Bill Weiss Oct 28 '09 at 15:53


"Normal" connections come from the range 1025-65535. Lots of OSes use a sub-range of that, such as 49152-65535 on Vista. List of ephemeral ports by OS.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.